tsk_get_files - "The Sleuth Kit"

Available for

tsk_get_files - "The Sleuth Kit"

tsk_get_files is a script that uses "The Sleuth Kit" commands "fls" and "icat" to rebuild a file structure from a disk image. Although TSK is intended for use forensics purposes, this script can be used when a user's home directory is accidentally removed, either by an admin or a user.